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Abstract. Recently, Indesteege et al. [T] had described attacks against 
23 and 24-step SHA-512 at SAC '08. Their attacks are based on the 
differential path by Nikolic and Biryukov [2]. The reported complexities 
are 2 44,9 and 2 53 calls to the respective step reduced SHA-512 hash func- 
tion. They provided colliding message pairs for 23-step SHA-512 but did 
not provide a colliding message pair for 24-step SHA-512. In this note 
we provide a colliding message pair for 23-step SHA-512 and the first 
colliding message pair for 24-step SHA-512. Our attacks use the differen- 
tial path first described by Sanadhya and Sarkar at ACISP '08 [3]. The 
complexities of our attacks are 2 16 ' 5 and 2 34,5 calls to the respective step 
reduced SHA-512 hash function. Complete details of the attacks will be 
provided in an extended version of this note. 



1 Colliding Message Pairs 

In [J], 23 and 24-step SHA-256 attacks are described. Similar attacks will 
also work for 23 and 24-step SHA-512. Complete details of these attacks 
will be provided later. For notation see [4]. 

A set of suitable values of 62, a, A, fi and 7 for the 23-step SHA-512 col- 
lision is the following. <5 2 = 0x600000000237, a = 0x7201b90f 9f 8df 85e, 
A = 0x3e000007ffdc9, ^ = 0x43fffff 800001 and 7 = 0x1. 

Values of the constants for 24-step SHA-512 collision is the following. 
5i = 0x200000000008, 5 2 = 0x600000000237, a = 0x7201b90f 9f 8df 85e, 
A = 0x3e000007ffdc9, fi = 0x45fffff 800009, 7 = 0x1. The colliding 
message pairs are provided in Table [Hand Table [2] next. 
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Table 1. Colliding message pair for 23-step SHA-512 with standard IV. 



Wi 


0-3 


b9f a6f c4729ca55c 


8718310elb3590el 


Id3d530cb075b721 


99166b30ecbdd705 




4-7 


27ed55b66c090b62 


754b2163ff6feec5 


6685f40fd8ab08f8 


590clc0522f6fdfd 




8-11 


b947bb4013b688cl 


d9d72ca8ablcac04 


69d0el20220d4edc 


30a2e93aeef 24e3f 




12-15 


84e76299718478b9 


f Ilae711647763e5 


d621d2687946e862 


0ee57069123ecc8b 


w 2 


0-3 


b9f a6f c4729ca55c 


8718310elb3590el 


Id3d530cb075b721 


99166b30ecbdd705 




4-7 


27ed55b66c090b62 


754b2163ff6feec5 


6685f40fd8ab08f8 


590clc0522f6fdfd 




8-11 


b947bb4013b688c2 


d9d72ca8ablcac03 


69d0el20220d4edc 


30a3493aeef25076 




12-15 


84e76299718478b9 


f Ilae711647763e5 


d621d2687946e862 


0ee57069123ecc8b 



Table 2. Colliding message pair for 24-step SHA-512 with standard IV. 



Wi 


0-3 


dedb689cfc766965 


c7b8e064ff720f7c 


cl36883560348c9c 


3747df7d0cf47678 




4-7 


855el7555cfedc5f 


88566babccaa63e9 


5dda9777938b73cd 


bl7b00574a4e4216 




8-11 


86f3ff48fdl2eal9 


Cdl5c6f8d6da38ce 


5e2c6b7b0411e70b 


36ed67e93a794e66 




12-15 


Ib65e96b02767821 


04d0950089db6c68 


5bc9b9673e38eff3 


b05d879ad024d3fa 




0-3 


dedb689cfc766965 


c7b8e064ff720f7c 


cl36883560348c9c 


3747df7d0cf47678 




4-7 


855el7555cfedc5f 


88566babccaa63e9 


5dda9777938b73cd 


bl7b00574a4e4216 




8-11 


86f3ff48fdl2eal9 


Cdl5c6f8d6da38ce 


5e2c6b7b0411e70c 


36ed67e93a794e65 




12-15 


Ib66096b02767829 


04d0f50089db6e9f 


5bc9b9673e38eff3 


b05d879ad024d3fa 
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